CVE-2025-4123

A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF. The default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.

• CWE-79
• CWE-601

• https://grafana.com/blog/2025/05/23/grafana-security-release-medium-and-high-severity-security-fixes-for-cve-2025-4123-and-cve-2025-3580/Vendor Advisory
• https://grafana.com/security/security-advisories/cve-2025-4123/Vendor Advisory
• https://www.exploit-db.com/exploits/52491

Published

May 22, 2025

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-41224A vulnerability has been identified in RUGGEDCOM RMC8388 V5.…8.8
• CVE-2025-41225The vCenter Server contains an authenticated command-executi…8.8
• CVE-2025-41226VMware ESXi contains a denial-of-service vulnerability that …6.8
• CVE-2025-41227VMware ESXi, Workstation, and Fusion contain a denial-of-ser…5.5
• CVE-2025-41228VMware ESXi and vCenter Server contain a reflected cross-sit…4.3
• CVE-2025-41229VMware Cloud Foundation contains a directory traversal vulne…8.2
• CVE-2025-41230VMware Cloud Foundation contains an information disclosure v…7.5
• CVE-2025-41231VMware Cloud Foundation contains a missing authorisation vul…7.3
• CVE-2025-41232Spring Security Aspects may not correctly locate method secu…9.1
• CVE-2025-41233Description: VMware AVI Load Balancer contains an authentic…6.8
• CVE-2025-41234Description In Spring Framework, versions 6.0.x as of 6.0.5…6.5
• CVE-2025-41235Spring Cloud Gateway Server forwards the X-Forwarded-For and…8.6